mcp-v8: a V8 isolate for agent code
mcp-v8
A Rust MCP server where the agent runs JavaScript and TypeScript in a V8 sandbox with one run_js tool and state kept between calls
- 64 ★ on the repository
- Last commit
- AGPL-3.0
Broad access
Why this level
- The agent runs arbitrary code, and policies can open network, files and subprocesses to it
- An open HTTP endpoint executes submitted scripts and needs JWKS protection
Install
- Works in
Manual install
claude mcp add mcp-v8 -- mcp-v8 --statelessStateless mode. To keep the heap use --directory-path /tmp/mcp-v8-heaps.
Access and checks
How we reviewBroad accessThe tool can change data, run commands or handle secrets.
- The agent runs arbitrary code, and policies can open network, files and subprocesses to it
- An open HTTP endpoint executes submitted scripts and needs JWKS protection
This is third-party code. Review the repository files before installing.
What it does
Instead of dozens of narrow tools the agent gets one, run_js, and writes a program itself: loops, branching, data transforms and calls to other tools. The README notes this usually costs noticeably fewer tokens than chains of calls. In stateful mode the V8 heap is saved as a content-addressed snapshot, so variables and objects survive several turns. Stateless mode is switched on with --stateless. Host capabilities, namely network, filesystem, subprocesses, WebAssembly, module imports and calls to other MCP servers, are off by default and unlocked only by OPA and Rego policies. For hard confinement there is an optional --sandbox-manifest based on nono that confines the whole process with Landlock on Linux and Seatbelt on macOS. The server speaks stdio, Streamable HTTP and SSE, has a REST sidecar at /api/exec, async execution with pagination, JWKS auth and Raft clustering.
Who it is for. Agent builders who need a safe environment for model-written code and token savings over call chains.
Good fit when
- The agent got a large JSON and should process it with one program instead of dozens of calls
- You want shared variable memory across dialogue turns without a database
- Model-written code must run with network and files denied by default
- One MCP server should call others through policy and collect their replies in a script
- You need an HTTP sidecar to run scripts from CI or other services
Not a fit when
- You need Python, shell or arbitrary packages: the server runs JavaScript and TypeScript only
- You need full container-level isolation: the built-in process sandbox does not replace a virtual machine
- You need a license that allows closed redistribution: the repository is under AGPL-3.0
Example request
Run JavaScript: take an array of 1000 numbers, filter the even ones, compute the sum and keep the result in a variable for the next step.MCP
- Transport
- stdio, http, sse
- Authentication
- not required
Limitations
To let code reach the network or read files you must write OPA and Rego policies, and a policy mistake widens what a script can do. The install script in the README runs through curl and sudo, and the Railway template has its own guide. Prebuilt binaries cover Linux x86_64 and arm64 and macOS on Apple Silicon. Raft clustering, JWKS and sandbox manifest mode target production but need separate setup. The AGPL-3.0 license brings obligations for networked use of modified code.
How to disable. Run claude mcp remove mcp-v8 and delete the mcp-v8 binary from /usr/local/bin. Heap snapshots live in the --directory-path folder and can be erased.
FAQ
How does stateful differ from stateless?
In stateful mode the V8 heap is saved as a snapshot in the --directory-path folder and values stay available in later calls. The --stateless mode stores nothing between calls.
How do I let a script use the network?
Through an OPA and Rego policy: fetch, filesystem, subprocesses and imports are denied until a policy explicitly opens them. Details are in the policy documentation.
Which transports does it support?
Stdio, Streamable HTTP and SSE. For HTTP start with --http-port, the MCP endpoint is /mcp and the REST sidecar is /api/exec.
How do I install the server?
With the install.sh script from the README, through nix run github:r33drichards/mcp-js, through Docker or by building from source. A Railway template is available.
What does the kernel sandbox add?
The --sandbox-manifest option confines the whole process by a nono capability manifest: Landlock on Linux and Seatbelt on macOS. It is opt-in and complements V8 isolation.
Discussion
No questions or reviews yet.
Related
MCP serversAn MCP server and CLI for code research: search and understand your project and all of GitHub with fewer tokens
rust-analyzer MCP: Rust code navigation for agents
r3bl-rust-analyzer-mcp-server
A Rust MCP server on standard threads: the agent gets hover info, go to definition, references, formatting and compiler diagnostics from rust-analyzer
An MCP server that lets an agent read files, search code and run commands in a workspace
A fast MCP server in Rust extended with WebAssembly plugins: plugins load from OCI, files, http(s) and s3, and OCI signatures can be verified
A debugger with no IDE: an agent sets breakpoints, steps through code and inspects variables in ten languages
An MCP server that indexes code with tree-sitter so an agent reads single symbols, not files, traces paths and weighs edits
Comparison with similar tools
Cards that share the main search query, and how they differ.
| Tool | Official | Authentication | Repository stars | Main difference |
|---|---|---|---|---|
| mcp-v8: a V8 isolate for agent code (this card) | no | not required | 64 | |
| Ephemeral Sandbox | no | not required | 125 | ephemeral sandboxes for running code, not a one-tool V8 isolate |
| LLM Sandbox MCP | no | not required | 1,143 | a container-based code sandbox, a different isolation model |
README in short
The README describes the idea of the single run_js tool, its advantages, a quick start with installation and client setup, running over HTTP and one-file TOML or JSON configuration. Full documentation lives on the project site.